Skip to content
Threat Feed
Subscribe

Tag

Webhooks

2 briefs RSS
high advisory

pytonapi Webhook Custom Path Authentication Bypass (GHSA-3fcr-jvgp-7f58)

The pytonapi library, specifically version 2.2.0, contains an authentication bypass vulnerability (GHSA-3fcr-jvgp-7f58) in its TonapiWebhookDispatcher, allowing unauthenticated remote attackers to send forged payloads to custom webhook endpoints, triggering victim-defined business logic and causing integrity impact.

pytonapi authentication-bypass webhooks python
1r 1t
high advisory

Non-Constant-Time HMAC Comparison in Pay Gem Paddle Billing Webhook Signature Verifier

A timing side-channel vulnerability in the `Pay` gem's Paddle Billing webhook signature verification component (`Pay::Webhooks::PaddleBillingController#valid_signature?` <= v11.6.1) allows an unauthenticated attacker to recover the HMAC signing secret by observing response time variations in `String#==` comparisons, enabling the forgery of arbitrary webhook events and leading to business logic abuses such as unauthorized feature provisioning or fraudulent refunds.

pay timing-attack vulnerability webhooks ruby-on-rails server-side logic-error remote-code-execution
3t